Re: php running as user apache
| From: | CPT John W. Holmes | Date: | Tue, 20 Jan 2004 16:45:52 +0000 |
| Subject: | Re: php running as user apache | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-175155@lists.php.net to get a copy of this message | ||
From: "Nirnimesh" <nirnimesh@students.iiit.net>
> My question relates to using php for handling file uploads. Since php runs
> as user apache, using it to manage file uploads means that I need to give
> write permissions to the user apache, which is a near-to-nobody user, i.e.
> 0+w permissions. Now does that not mean that anyone who can run a php
> script on the server can write to my account?
Yep.
> Is there any configuration setting that I need to fix, for this seems to
> me to be too trivial to be a bug, but still I know it can be used with
> fatal effects.
Turn safe_mode on or put open_basedir (?) restrictions in effect. The manual
will have more info.
---John Holmes...